Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Removed broken type conversion in NSG resource #564

Conversation

voojoe
Copy link
Contributor

@voojoe voojoe commented Nov 19, 2021

Signed-off-by: Joe McCrea joe.mccrea@sap.com

Description

We discovered an issue when scanning certain Network Security Groups.

Within the 'destination_port_ranges' function, which takes 'properties' as an argument, a type conversion is done on 'properties' to convert it to a hash. This does not work and causes a nil value to be assigned to the new 'properties_hash' variable.

Any time this is then used it does not return the expected value, meaning that the proper checks are not carried out in order to return the correct value for the destination port ranges. The only reason this is not very visible or obvious is due to the values returned from the Azure API, as when 'destinationPortRanges' is returned, 'destinationPortRange' is not returned at all in the response. However when 'destinationPortRange' is returned, an empty value is returned for 'destinationPortRanges' here, which makes it look like the checks have worked even though they have not.

Issues Resolved

Bug in specific situations when the Network Security Group resource is used.

Check List

Signed-off-by: Joe McCrea <joe.mccrea@sap.com>
@voojoe voojoe requested a review from a team as a code owner November 19, 2021 17:27
@sonarqubecloud
Copy link

Kudos, SonarCloud Quality Gate passed!    Quality Gate passed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 0 Code Smells

No Coverage information No Coverage information
No Duplication information No Duplication information

Copy link
Contributor

@sathish-progress sathish-progress left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@sathish-progress sathish-progress added the Version: Bump Minor Used by github.minor_bump_labels to bump the Minor version number. label Nov 22, 2021
@sathish-progress sathish-progress merged commit e06d864 into inspec:main Nov 22, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
CFT Support Version: Bump Minor Used by github.minor_bump_labels to bump the Minor version number.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants